update

checker/raw_result.go

@@ -280,7 +280,6 @@ const (
 // TokenPermission defines a token permission result.
 type TokenPermission struct {
 	Job          *WorkflowJob
-	Remediation  *Remediation
 	LocationType *PermissionLocation
 	Name         *string
 	Value        *string

checks/evaluation/permissions.go

@@ -19,6 +19,7 @@ import (
 
 	"github.com/ossf/scorecard/v4/checker"
 	sce "github.com/ossf/scorecard/v4/errors"
+	"github.com/ossf/scorecard/v4/remediation"
 )
 
 type permissions struct {
@@ -55,13 +56,19 @@ func applyScorePolicy(results *checker.TokenPermissionsData, dl checker.DetailLo
 	hm := make(map[string]permissions)
 
 	for _, r := range results.TokenPermissions {
-		msg := checker.LogMessage{Remediation: r.Remediation}
+		var msg checker.LogMessage
+
 		if r.File != nil {
 			msg.Path = r.File.Path
 			msg.Offset = r.File.Offset
 			msg.Type = r.File.Type
 			msg.Snippet = r.File.Snippet
+
+			if msg.Path != "" {
+				msg.Remediation = remediation.CreateWorkflowPermissionRemediation(r.File.Path)
+			}
 		}
+
 		text, err := createMessage(r)
 		if err != nil {
 			return checker.MinResultScore, err

checks/permissions.go

@@ -19,6 +19,7 @@ import (
 	"github.com/ossf/scorecard/v4/checks/evaluation"
 	"github.com/ossf/scorecard/v4/checks/raw"
 	sce "github.com/ossf/scorecard/v4/errors"
+	"github.com/ossf/scorecard/v4/remediation"
 )
 
 // CheckTokenPermissions is the exported name for Token-Permissions check.
@@ -38,6 +39,10 @@ func init() {
 
 // TokenPermissions will run the Token-Permissions check.
 func TokenPermissions(c *checker.CheckRequest) checker.CheckResult {
+	if err := remediation.Setup(c); err != nil {
+		return checker.CreateRuntimeErrorResult(CheckTokenPermissions, err)
+	}
+
 	rawData, err := raw.TokenPermissions(c)
 	if err != nil {
 		e := sce.WithMessage(sce.ErrScorecardInternal, err.Error())